Global risk: political, currency and compliance risk

Dr. Tan starts the eleventh session with a question she was once asked by a board: what is the worst thing that could happen to us abroad? Owen's answer is a war that closes a plant. Leo's is a data breach that brings a regulator's fine. Hana suggests a scandal in a supplier's factory that ends up on the front page. Dr. Tan says that all three are right, and that the hardest part of managing international risk is that it comes in many forms, most of them unlikely in any given year and some of them catastrophic. A company cannot avoid risk by staying at home, but it can decide which risks to take, how to measure them and what to do about them.

A map of international risks

International risks fall into several families. Political risk is the possibility that political events or government decisions will harm a company's interests. Macro political risks affect all foreign firms in a country: war, civil unrest, revolution, expropriation and sudden changes of regime. Micro political risks affect particular industries or firms: a new regulation, a tax on a sector, the withdrawal of a permit, or a government's decision to favor a local rival. Policy volatility, frequent changes in rules such as tariffs, is a form of political risk that has risen sharply in rich democracies since 2018. Geopolitical risk, discussed in lesson 10, arises from rivalry between states and can turn a supplier, customer or partner into a target of sanctions or controls.

Financial risks include currency risk, discussed in lesson 4; transfer risk, the possibility that a government will restrict conversion or transfer of money out of the country; and the credit risk of foreign customers and partners. Compliance risks arise from the laws a company must follow when it operates abroad: anti-bribery laws, sanctions, export controls, data protection rules, tax laws, customs rules and labor and environmental standards. Operational risks include the security of staff and assets, natural disasters and disruptions to supply chains. Reputational risk, the risk that a company's conduct or that of its partners will damage its standing with customers, employees, investors or governments, cuts across all of these.

Assessing risk

Risk assessment begins with a register: a list of the risks a company faces in each market, with an estimate of each risk's likelihood over a period and its impact if it occurs. Plotting risks on a heat map, with likelihood on one axis and impact on the other, shows at a glance which deserve attention. Risks with high likelihood and high impact require action; those with low likelihood but very high impact, such as war or expropriation, require contingency plans and often insurance; those with high likelihood but low impact, such as routine delays, can be managed in the course of business; and those low on both can be monitored.

Where possible, risks should be quantified. The expected loss from a risk is its probability multiplied by its impact. For a project, risks can be reflected either by adjusting cash flows for expected losses, or by adding a premium to the discount rate, as lesson 4 described. Adjusting cash flows is usually more transparent, because it forces managers to state what they think could go wrong and how likely it is. Scenario analysis, which the cohort used in MBA-514, captures risks that change many variables at once, such as a recession combined with a currency crisis.

# Risk register: expected annual loss and priority for a company's foreign operations (thousands)
risks = [  # name, annual probability, impact if it occurs
    ("Tariff increase on main export market", 0.30, 1800),
    ("Currency move of 15 per cent against home currency", 0.20, 900),
    ("Data protection fine and remediation", 0.04, 4000),
    ("Worker abuse scandal at a key supplier", 0.06, 3500),
    ("Sanctions imposed on a distributor's owner", 0.02, 2500),
    ("Expropriation of a foreign plant", 0.005, 30000),
    ("Shipping lane closure for three months", 0.10, 1200),
]
def zone(p, impact):
    if p >= 0.15 and impact >= 1000: return "act now"
    if impact >= 3000: return "contingency plan or insure"
    if p >= 0.15: return "manage routinely"
    return "monitor"
total = 0
for name, p, impact in sorted(risks, key=lambda r: -r[1] * r[2]):
    el = p * impact
    total += el
    print(f"{name:<52} expected loss {el:6.0f}  -> {zone(p, impact)}")
print(f"total expected annual loss: {total:,.0f}")

Tariff increase on main export market                expected loss    540  -> act now
Worker abuse scandal at a key supplier               expected loss    210  -> contingency plan or insure
Currency move of 15 percent against home currency   expected loss    180  -> manage routinely
Data protection fine and remediation                 expected loss    160  -> contingency plan or insure
Expropriation of a foreign plant                     expected loss    150  -> contingency plan or insure
Shipping lane closure for three months               expected loss    120  -> monitor
Sanctions imposed on a distributor's owner           expected loss     50  -> monitor
total expected annual loss: 1,410

The register shows why expected loss alone is not enough. Expropriation has a tiny probability, but its impact would be ruinous, so it calls for insurance and contingency planning even though its expected loss is modest. Tariff increases are likely and costly enough to need action now, while currency moves are frequent but manageable in the normal course of business. The value of the exercise lies less in the numbers, which are rough, than in the conversation it forces among managers about what could go wrong and what they would do.

Responding to risk

Companies have four broad responses. They can avoid a risk by not entering a market, not dealing with a partner or withdrawing from an activity. They can reduce it, for example by diversifying suppliers, building local partnerships, keeping assets mobile or hedging currencies. They can transfer it, through insurance, contracts that shift risks to others, or financing structures that involve international lenders. Or they can accept it, deliberately, when the expected return justifies it and the company can bear the worst case. The choice should match the company's risk appetite, which boards increasingly state explicitly.

Political risk insurance covers losses from expropriation, political violence, currency inconvertibility and breach of contract by governments. It is offered by private insurers, by national export credit and development agencies, including the US International Development Finance Corporation, and by the World Bank's Multilateral Investment Guarantee Agency. Insurance is not a substitute for judgment, but its availability and price are useful signals: insurers who refuse cover or charge high premiums for a country are telling a company something.

Anti-bribery laws

Bribery of foreign officials is illegal under the laws of most countries where multinationals are based. The Foreign Corrupt Practices Act of 1977 prohibits American companies, citizens and companies listed on American exchanges from bribing foreign officials, and requires listed companies to keep accurate books and adequate internal controls. In February 2025 an executive order paused new enforcement for review; in June 2025 the Justice Department issued guidelines resuming enforcement with a focus on cases linked to cartels and transnational criminal organizations, on bribery that harms American companies' ability to compete, on threats to national security and on serious misconduct by individuals. The law itself is unchanged, the statute of limitations is generally five years, and future administrations could prosecute conduct that occurs today.

The United Kingdom's Bribery Act of 2010 is broader still: it covers bribery of private parties as well as officials and makes a company liable for failing to prevent bribery by anyone acting on its behalf, unless it had adequate procedures in place. Because it applies to any company that carries on business in the United Kingdom, many North American companies are covered. The common lesson of these laws is that a company is responsible not only for its employees but for its agents, distributors, consultants and joint venture partners, who are the source of most bribery cases.

Sanctions and export controls

Sanctions prohibit dealings with designated countries, entities and individuals. The United States imposes sanctions mainly through the Treasury Department's Office of Foreign Assets Control, whose list of Specially Designated Nationals is the most widely used screening list in the world. American sanctions also apply to entities owned 50 percent or more by designated parties, and some American sanctions are secondary, threatening penalties for non-American companies that deal with sanctioned parties. The European Union, the United Kingdom and others maintain their own lists, which overlap but do not match. Violations can bring large fines and, for individuals, imprisonment.

Export controls restrict the export of goods, software and technology that have military or dual uses, from encryption software to advanced chips and machine tools. Canada controls exports through its Export Control List; the United States through the Export Administration Regulations and the Entity List of restricted foreign parties. Controls can apply even to technology shared by email or to foreign nationals within the home country. Companies manage these risks by screening every customer, supplier, distributor and owner against sanctions and restricted-party lists, classifying their products under export control rules, and building controls into their order and shipping systems so that a prohibited transaction is stopped automatically.

Data protection

Data protection has become a major compliance area for any company that collects personal information from customers or employees in another country. The European Union's General Data Protection Regulation, in force since May 2018, applies to any company that offers goods or services to people in the EU or monitors their behavior, wherever the company is based. It requires a lawful basis for processing data, gives individuals rights to access and delete their data, requires notification of breaches, restricts transfers of data outside the EU and allows fines of up to 4 percent of global annual revenue. Transfers to the United States rely mainly on the EU–US Data Privacy Framework adopted in 2023; transfers to Canada benefit from an EU finding that Canadian private-sector law provides adequate protection. In the United States, more than twenty states now have comprehensive privacy laws, and companies selling across states must reconcile their differences. Leo's Kestrel, which processes data for European retailers, must meet GDPR requirements as a processor on its customers' behalf.

Building a compliance program

Regulators in many countries describe what an effective compliance program looks like, and they consider it when deciding whether to prosecute a company and what penalties to seek. The common elements are a clear commitment from the board and senior leaders; written policies on bribery, gifts, sanctions, export controls and data; a risk assessment that directs effort to the highest-risk markets, products and partners; due diligence on third parties before and during relationships; training tailored to the risks people face; confidential channels for raising concerns, with protection against retaliation; investigation of reports and discipline for violations; and regular testing and improvement. A program that exists on paper but is ignored in practice offers no protection and can be evidence of a company's indifference.

Dr. Tan returns to her earlier point. The most effective protection in international business is a reputation for clear rules. Agents, officials and partners quickly learn which companies will not pay, will not cut corners on sanctions and will walk away from a deal that requires it, and they stop asking. Building that reputation costs some business in the short run and saves far more in the long run.